mirror of
https://github.com/shmilylty/OneForAll.git
synced 2026-08-26 04:47:48 +08:00
更新文档
This commit is contained in:
Jing Ling
+6
-8
@@ -20,6 +20,7 @@ Project address ：[https://github.com/shmilylty/OneForAll](https://github.com/s
|
||||
The importance of information collection in penetration testing is self-evident. Subdomain collection is an essential and very important part of information collection. At present, there are many open source tools for subdomain collection on the Internet, but there are always some of the following problems:
|
||||
|
||||
* **Not powerful enough**，there are not enough interfaces to collect subdomains automatically, and there are no functions such as automatic subdomain resolve, verification, FUZZ and information expansion.
|
||||
|
||||
* **Not friendly enough**，although the command line module is more convenient, but when there are a lot of optional parameters and the operation to be implemented is complex, using command line mode is a bit unfriendly. If there is a good interaction, With a highly operable front end, the experience will be much better.
|
||||
|
||||
* **Lack of maintenance**，Many tools have not been updated once in years, what issues and PR are, do not exist.
|
||||
@@ -34,17 +35,11 @@ At present, OneForAll is still under development, there must be a lot of problem
|
||||
|
||||
* **Powerful collection capability**，For more information, please see [collection module description](https://github.com/shmilylty/OneForAll/tree/master/docs/collection_modules.md).
|
||||
1. Collect subdomains using certificate transparency (there are currently 6 modules: `censys_api`，`certspotter`，`crtsh`，`entrust`，`google`，`spyse_api`）
|
||||
|
||||
2. General check collection subdomains (there are currently 4 modules: domain transfer vulnerability exploitation`axfr`, cross-domain policy file `cdx`, HTTPS certificate `cert`, content security policy `csp`, robots file `robots`, and sitemap file `sitemap`. Check NSEC record, NSEC3 record and other modules will be added later).
|
||||
|
||||
3. Collect subdomains using web crawler files (there are currently 2 modules: `archirawl`, `commoncrawl`, which is still being debugged and needs to be added and improved).
|
||||
|
||||
4. Collect subdomains using DNS datasets (there are currently 23 modules: `binaryedge_api`, `bufferover`, `cebaidu`, `chinaz`, `chinaz_api`, `circl_api`, `dnsdb_api`, `dnsdumpster`, `hackertarget`, `ip138`, `ipv4info_api`, `netcraft`, `passivedns_api`, `ptrarchive`, `qianxun`, `rapiddns`, `riddler`, `robtex`, `securitytrails_api`, `sitedossier`, `threatcrowd`, `wzpc`, `ximcx`）
|
||||
|
||||
5. Collect subdomains using DNS queries (There are currently 5 modules: collecting subdomains `srv` by enumerating common SRV records and making queries, and collecting subdomains by querying MX,NS,SOA,TXT records in DNS records of domain names).
|
||||
|
||||
6. Collect subdomains using threat intelligence platform data (there are currently 6 modules: `alienvault`, `riskiq_ api`, `threatbook_ api`, `threatkeeper `, `virustotal`, `virustotal_ api`, which need to be added and improved).
|
||||
|
||||
7. Use search engines to discover subdomains (there are currently 18 modules: `ask`, `baidu`, `bing`, `bing_api`, `duckduckgo`, `exalead`, `fofa_api`, `gitee`, `github`, `github_api`, `google`, `google_api`, `shodan_api`, `so`, `sogou`, `yahoo`, `yandex`, `zoomeye_api`), except for special search engines in the search module. General search engines support automatic exclusion of search, full search, recursive search.
|
||||
* **Support subdomain blasting**，This module has both conventional dictionary blasting and custom fuzz mode. It supports batch blasting and recursive blasting, and automatically judges pan-parsing and processing.
|
||||
* **Support subdmain verification**，default to enable subdomain verification, automatically resolve subdomain DNS, automatically request subdomain to obtain title and banner, and comprehensively determine subdomain survival.
|
||||
@@ -90,14 +85,16 @@ pip 19.2.2 from C:\Users\shmilylty\AppData\Roaming\Python\Python37\site-packages
|
||||
|
||||
Since the project is under development and will continue to be updated iteratively, `git clone` is used to clone the latest code repository during download, which is also convenient for subsequent updates. Downloading from Releases is not recommended because the update of the version in Releases is slow and inconvenient.
|
||||
|
||||
You can install OneForAll dependencies via pip3 (if you are familiar with [pipenv](https://docs.pipenv.org/en/latest/), then it is recommended that you use [pipenv install dependencies](https://github.com/shmilylty/OneForAll/tree/master/docs/Installation_dependency.md), the following is an example of using **pip3** to install dependencies under **Windows system**: (Note: If your Python3 is installed in the system Program Files In the directory, such as: `C:\Program Files\Python38`, then run the command prompt cmd as an administrator to execute the following command!)
|
||||
You can install OneForAll dependencies via pip3, the following is an example of using **pip3** to install dependencies under **Windows system**: (Note: If your Python3 is installed in the system Program Files In the directory, such as: `C:\Program Files\Python38`, then run the command prompt cmd as an administrator to execute the following command!)
|
||||
|
||||
```bash
|
||||
cd OneForAll/
|
||||
python -m pip install -U pip setuptools wheel
|
||||
pip3 install -r requirements.txt
|
||||
python oneforall.py --help
|
||||
```
|
||||
For other system platforms, please refer to [dependency installation](https://github.com/shmilylty/OneForAll/tree/master/docs/installation_dependency.md). If you find that compiling a dependent library fails during the installation dependencies, Refer to the solution in the [troubleshooting.md](https://github.com/shmilylty/OneForAll/tree/master/docs/troubleshooting.md) documentation, if not resolved, welcome feedback.
|
||||
|
||||
For other system platforms, please refer to [dependency installation](https://github.com/shmilylty/OneForAll/tree/master/docs/installation_dependency.md). If you find that compiling a dependent library fails during the installation dependencies, Refer to the solution in the [troubleshooting.md](https://github.com/shmilylty/OneForAll/tree/master/docs/troubleshooting.md) documentation, if not resolved, welcome feedback.
|
||||
|
||||
3. **Update**
|
||||
|
||||
@@ -231,6 +228,7 @@ The OneForAll command line interface is based on [Fire](https://github.com/googl
|
||||
```
|
||||
|
||||
## 🌲Directory structure
|
||||
|
||||
For the description of the project's directory structure, please refer to [directory_structure](https://github.com/shmilylty/OneForAll/tree/master/docs/directory_structure.md).
|
||||
|
||||
Description of the source of the subdomain dictionary::
|
||||
|
||||
@@ -21,9 +21,7 @@
|
||||
|
||||
* **不够强大**，子域收集的接口不够多，不能做到对批量子域自动收集，没有自动子域解析，验证，FUZZ以及信息拓展等功能。
|
||||
* **不够友好**，固然命令行模块比较方便，但是当可选的参数很多，要实现的操作复杂，用命令行模式就有点不够友好，如果有交互良好，高可操作的前端那么使用体验就会好很多。
|
||||
|
||||
* **缺少维护**，很多工具几年没有更新过一次，issues和PR是啥，不存在的。
|
||||
|
||||
* **效率问题**，没有利用多进程，多线程以及异步协程技术，速度较慢。
|
||||
|
||||
为了解决以上痛点，此项目应用而生，正如其名，我希望OneForAll是一款集百家之长，功能强大的全面快速子域收集终极神器🔨。
|
||||
@@ -34,17 +32,11 @@
|
||||
|
||||
* **收集能力强大**，详细模块请阅读[收集模块说明](https://github.com/shmilylty/OneForAll/tree/master/docs/collection_modules.md)。
|
||||
1. 利用证书透明度收集子域（目前有6个模块：`censys_api`，`certspotter`，`crtsh`，`entrust`，`google`，`spyse_api`）
|
||||
|
||||
2. 常规检查收集子域（目前有4个模块：域传送漏洞利用`axfr`，检查跨域策略文件`cdx`，检查HTTPS证书`cert`，检查内容安全策略`csp`，检查robots文件`robots`，检查sitemap文件`sitemap`，后续会添加检查NSEC记录，NSEC3记录等模块）
|
||||
|
||||
3. 利用网上爬虫档案收集子域（目前有2个模块：`archivecrawl`，`commoncrawl`，此模块还在调试，该模块还有待添加和完善）
|
||||
|
||||
4. 利用DNS数据集收集子域（目前有23个模块：`binaryedge_api`, `bufferover`, `cebaidu`, `chinaz`, `chinaz_api`, `circl_api`, `dnsdb_api`, `dnsdumpster`, `hackertarget`, `ip138`, `ipv4info_api`, `netcraft`, `passivedns_api`, `ptrarchive`, `qianxun`, `rapiddns`, `riddler`, `robtex`, `securitytrails_api`, `sitedossier`, `threatcrowd`, `wzpc`, `ximcx`）
|
||||
|
||||
5. 利用DNS查询收集子域（目前有5个模块：通过枚举常见的SRV记录并做查询来收集子域`srv`，以及通过查询域名的DNS记录中的MX,NS,SOA,TXT记录来收集子域）
|
||||
|
||||
6. 利用威胁情报平台数据收集子域（目前有6个模块：`alienvault`, `riskiq_api`，`threatbook_api`，`threatminer`，`virustotal`，`virustotal_api`该模块还有待添加和完善）
|
||||
|
||||
7. 利用搜索引擎发现子域（目前有18个模块：`ask`, `baidu`, `bing`, `bing_api`, `duckduckgo`, `exalead`, `fofa_api`, `gitee`, `github`, `github_api`, `google`, `google_api`, `shodan_api`, `so`, `sogou`, `yahoo`, `yandex`, `zoomeye_api`），在搜索模块中除特殊搜索引擎，通用的搜索引擎都支持自动排除搜索，全量搜索，递归搜索。
|
||||
* **支持子域爆破**，该模块有常规的字典爆破，也有自定义的fuzz模式，支持批量爆破和递归爆破，自动判断泛解析并处理。
|
||||
* **支持子域验证**，默认开启子域验证，自动解析子域DNS，自动请求子域获取title和banner，并综合判断子域存活情况。
|
||||
@@ -89,13 +81,15 @@ pip 19.2.2 from C:\Users\shmilylty\AppData\Roaming\Python\Python38\site-packages
|
||||
|
||||
2. **安装**
|
||||
|
||||
你可以通过pip3安装OneForAll的依赖（如果你熟悉[pipenv](https://docs.pipenv.org/en/latest/)，那么推荐你使用[pipenv安装依赖]((https://github.com/shmilylty/OneForAll/tree/master/docs/Installation_dependency.md))），以下为**Windows系统**下使用**pip3**安装依赖的示例：（注意：如果你的Python3安装在系统Program Files目录下，如：`C:\Program Files\Python38`，那么请以管理员身份运行命令提示符cmd执行以下命令！）
|
||||
你可以通过pip3安装OneForAll的依赖，以下为**Windows系统**下使用**pip3**安装依赖的示例：注意：如果你的Python3安装在系统Program Files目录下，如：`C:\Program Files\Python38`，那么请以管理员身份运行命令提示符cmd执行以下命令！
|
||||
|
||||
```bash
|
||||
cd OneForAll/
|
||||
python -m pip install -U pip setuptools wheel -i https://mirrors.aliyun.com/pypi/simple/
|
||||
pip3 install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
|
||||
python oneforall.py --help
|
||||
```
|
||||
|
||||
其他系统平台的请参考[依赖安装](https://github.com/shmilylty/OneForAll/tree/master/docs/installation_dependency.md)，如果在安装依赖过程中发现编译某个依赖库失败时可以参考[troubleshooting.md](https://github.com/shmilylty/OneForAll/tree/master/docs/troubleshooting.md)中解决方法，如果还没有解决欢迎加群反馈。
|
||||
|
||||
3. **更新**
|
||||
|
||||
@@ -1,76 +1,72 @@
|
||||
# 安装依赖
|
||||
|
||||
你可以通过pip3和pipenv两种方法安装OneForAll的依赖（熟悉哪种就用哪种）：
|
||||
|
||||
## Windows系统
|
||||
|
||||
注意：如果你的Python3安装在系统Program Files目录下，如：`C:\Program Files\Python38`，那么请以管理员身份运行命令提示符cmd执行以下命令！
|
||||
|
||||
1. 使用pipenv安装依赖
|
||||
```bash
|
||||
cd OneForAll/
|
||||
python -m pip install -U pip setuptools wheel -i https://mirrors.aliyun.com/pypi/simple/
|
||||
pip3 install pipenv -i https://mirrors.aliyun.com/pypi/simple/
|
||||
pipenv install --python 3.8
|
||||
pipenv run python oneforall.py --help
|
||||
```
|
||||
|
||||
2. 使用pip3安装依赖
|
||||
```bash
|
||||
cd OneForAll/
|
||||
python -m pip install -U pip setuptools wheel -i https://mirrors.aliyun.com/pypi/simple/
|
||||
pip3 install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
|
||||
python oneforall.py --help
|
||||
```
|
||||
|
||||
## Linux系统
|
||||
|
||||
* **Ubuntu/Debian系统(包括kali)**
|
||||
安装git
|
||||
### Ubuntu/Debian系统(包括kali)
|
||||
|
||||
1. 安装git
|
||||
```bash
|
||||
sudo apt update
|
||||
sudo apt install git
|
||||
sudo apt install git -y
|
||||
```
|
||||
|
||||
2. 克隆OneForAll项目
|
||||
```bash
|
||||
git clone https://gitee.com/shmilylty/OneForAll.git
|
||||
```
|
||||
|
||||
3. 安装相关依赖
|
||||
```bash
|
||||
cd OneForAll/
|
||||
sudo apt install python3-dev python3-pip python3-testresources -y
|
||||
sudo python3 -m pip install -U pip setuptools wheel -i https://mirrors.aliyun.com/pypi/simple/
|
||||
sudo pip3 install uvloop -i https://mirrors.aliyun.com/pypi/simple/
|
||||
sudo pip3 install --ignore-installed -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
|
||||
python3 oneforall.py --help
|
||||
```
|
||||
|
||||
### RHEL/Centos系统
|
||||
|
||||
1. 安装git
|
||||
```bash
|
||||
sudo yum update
|
||||
sudo yum install git -y
|
||||
```
|
||||
|
||||
2. 克隆OneForAll项目
|
||||
```bash
|
||||
git clone https://gitee.com/shmilylty/OneForAll.git
|
||||
```
|
||||
|
||||
3. 安装相关依赖
|
||||
```bash
|
||||
cd OneForAll/
|
||||
sudo yum install python3-devel python3-pip -y
|
||||
sudo python3 -m pip install -U pip setuptools wheel -i https://mirrors.aliyun.com/pypi/simple/
|
||||
sudo pip3 install uvloop -i https://mirrors.aliyun.com/pypi/simple/
|
||||
sudo pip3 install --ignore-installed -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
|
||||
python3 oneforall.py --help
|
||||
```
|
||||
|
||||
## Darwin系统
|
||||
|
||||
克隆OneForAll项目
|
||||
```bash
|
||||
git clone https://gitee.com/shmilylty/OneForAll.git
|
||||
```
|
||||
|
||||
安装python及开发依赖
|
||||
```bash
|
||||
sudo apt install python3.8 python3.8-dev python3-testresources
|
||||
```
|
||||
接下来你可以使用以下一种方式安装OneForAll的Python库依赖:
|
||||
1. 使用pipenv安装依赖
|
||||
```bash
|
||||
cd OneForAll/
|
||||
sudo python3.8 -m pip install -U pip setuptools wheel -i https://mirrors.aliyun.com/pypi/simple/
|
||||
sudo apt install pipenv
|
||||
sudo pipenv install --python 3.8
|
||||
pipenv run python3 oneforall.py --help
|
||||
```
|
||||
|
||||
2. 使用pip3安装依赖
|
||||
```bash
|
||||
cd OneForAll/
|
||||
sudo apt install python3-pip
|
||||
sudo python3.8 -m pip install -U pip setuptools wheel -i https://mirrors.aliyun.com/pypi/simple/
|
||||
sudo pip3 install uvloop -i https://mirrors.aliyun.com/pypi/simple/
|
||||
sudo pip3 install --ignore-installed -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
|
||||
python3.8 oneforall.py --help
|
||||
```
|
||||
## Darwin系统
|
||||
|
||||
1. 使用pipenv安装依赖
|
||||
```bash
|
||||
cd OneForAll/
|
||||
python3 -m pip install -U pip setuptools wheel -i https://mirrors.aliyun.com/pypi/simple/
|
||||
pip3 install pipenv -i https://mirrors.aliyun.com/pypi/simple/
|
||||
pipenv install --python 3.8
|
||||
pipenv run python3 oneforall.py --help
|
||||
```
|
||||
|
||||
2. 使用pip3安装依赖
|
||||
安装相关依赖
|
||||
```bash
|
||||
cd OneForAll/
|
||||
python3 -m pip install -U pip setuptools wheel -i https://mirrors.aliyun.com/pypi/simple/
|
||||
|
||||
Reference in New Issue
Block a user